DarkSly
Attribution profile
- Type
- Criminal
- Location
- Viet Nam
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2019-11-13
- Last seen
- 2019-11-13
- Updated
- 2026-10-17 01:44
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
DarkSly, also known as DarkSquid, is an individual hacker based in Viet Nam who describes himself as a greyhat actor. He has primarily targeted automotive companies, notably Hyundai Saudi Arabia and Jaguar/LandRover, extracting customer data from markets in Saudi Arabia, Iraq, Kuwait, the United Arab Emirates, Oman, Egypt, Mexico, Morocco, Lebanon, Qatar and Tunisia. His actions appear financially motivated: he demanded a 1 Bitcoin bug bounty and later threatened to sell the stolen data or release attack videos after his ransom requests were ignored. The actor claims to have obtained database credentials, root‑certificate access and even source code, indicating he exploited weak development practices to gain and maintain persistent server access. No malware families or specific tooling are described in the sources, and he explicitly denies any connection to state‑sponsored groups such as APT32/Ocean Lotus. Reported operations include the November 2019 Hyundai breach that exposed roughly 460 000–550 000 records containing names, emails, cities, bank affiliations, monthly salaries and phone numbers, and a subsequent December 2019 intrusion into Jaguar/LandRover systems across multiple regional branches where he asserted he had backed up databases and retained access.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.